Privacy Policy

1. 1. Who we are

   bombafesta is run by helio.fans (“we”). This policy explains what we keep about you when you play, on helio.fans or inside Discord, why, and for how long. We keep as little as we can.

2. 2. What we keep

   • Guests: the display name you choose, shown to the people in your Room.
   • Accounts: your username, a one-way hash of your password (never the password itself), the avatar you upload, and when you created the account and last changed your username. An account created from Discord starts with your Discord avatar and a username based on your Discord name, until you change them.
   • Recovery email (optional, for accounts with a password): the address you confirmed. While a code we emailed you is waiting to be used, to confirm an address or to set a new password, we also keep a one-way hash of the code (never the code itself) and the address it went to, until it is used or runs out. We email you only these codes and a notice when the address changes or is removed. We never show the address to others, sign you in with it or write to you about anything else.
   • Discord: when you open the Activity, Discord gives us your Discord user ID, username, display name and avatar (the “identify” permission). If you create or link an account, we keep your Discord user ID with it (see Accounts for the avatar and username). Otherwise we keep this only while you choose whether to create or link one. We never get your email address, servers, friends or messages from Discord.
   • Rooms: each Room keeps a log of who joined and left, under which name, the moves of each game and the chat messages. We use it to fix bugs and deal with abuse.
   • Your connection: your IP address is used, in memory only, to limit how fast requests can be made, and may appear in our server logs, which are overwritten as they fill up.

3. 3. Cookies and your device

   Signing in sets one cookie that keeps you signed in for up to 30 days. Your browser keeps your settings (language, sound, reduced motion, guest name) on your own device. Cloudflare, which carries our traffic, may set a cookie it needs to protect the site from abuse. We use no advertising or analytics cookies and no trackers.

4. 4. Who we share it with

   The people in your Room see your name, avatar, chat and moves. We do not sell your data or show ads. Beyond that, only these services handle it for us:

   • Oracle Cloud hosts our servers and backups.
   • Cloudflare protects and delivers every request to helio.fans, so it sees your IP address and what your browser asks for.
   • Resend sends our emails, so it receives your recovery email and the messages sent to it.
   • Discord handles your data under its own Privacy Policy when you play inside it.

5. 5. How long we keep it

   Account data stays until you delete your account from Settings, on helio.fans or inside Discord. That removes your account, sign-ins, avatar and recovery email. You can also remove just the recovery email from the account menu at any time.

   A Room's log is deleted 90 days after the Room closes, or a day after if nobody joined it. Until then it may still hold the names and chat messages you used, even after your account is gone; write to us and we will remove yours sooner. Nightly backups are kept for up to 90 days, so deleted data is gone from them by then.

6. 6. Your rights

   You can ask us for a copy of your data, or to correct or delete it. Write to us from the address below; we may ask you to show that the account is yours.

7. 7. Children

   bombafesta is not meant for children under 13, and we do not knowingly keep their data. If you think a child under 13 has an account, write to us and we will delete it.

8. 8. Changes to this policy

   We may update this policy as bombafesta changes. The date at the top says when it last changed.

Questions or requests: [email protected]